Live Traffic options don’t work

Hi @drgonzo3000,

Thank you for reaching out to us.

Can you please provide more information about the issue? Are all the entries on Live Traffic showing the same IP address?

If so, it could be an issue with IP detection. Please find your public-facing IP address here – https://whatismyipaddress.com/. Then look at Wordfence > All Options > General Wordfence Options > How does Wordfence gets IPs and cycle through the options until it displays the IP address above. That will be the setting you need to use going forward, so click the Save button once you’re done.

Let me know in case this doesn’t solve your issue.

Thanks,

Mark

Hi Mark,

The IP address is my IP as I want to filter out that traffic from the live logs, My ip is showing as all the same in the live logs. Not going to post my IP here but it is the correct ip address. Not filtering on username as I have bots trying to brute force login and I need to see those entries where they attempt to use my username.

Monitoring filtering is done using the monitors browser user-agent, which has to be done as the monitoring runs from various nodes around the world, but they all use the same identifies in the user-agent.

Uptime-robot uses- Mozilla/5.0+(compatible; UptimeRobot/2.0; https://www.uptimerobot.com/)
StatusCake uses – Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/98 Safari/537.4 (StatusCake)

I have the browser user agent filter set as:

"*UptimeRobot/2.0*", "*(StatusCake)*"

This is assuming it is string based comma separated filtering and that wildcarding is allowed. Your documentation does not list acceptable formats or give examples for any of this so I based it on standard wildcard string practice.

My monitoring runs every 5 mins form multiple nodes on both systems, so live logs are flooded with those status checks and I can’t seem to get them filtered out.

I have also just found an issue with the allowlist services, I have Statuscake and Uptime robot selected, but one of the Statuscake nodes checks is being blocked as I have a hostname block for AWS.

Activity Detail
 Stockholm, Sweden was blocked for UA/Hostname/Referrer/IP Range not allowed at /
12/20/2023 9:50:59 AM (7 minutes ago)  
IP: 13.48.110.214 Hostname: ec2-13-48-110-214.eu-north-1.compute.amazonaws.com
Human/Bot: Bot
Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/98 Safari/537.4 (StatusCake)

My hostname block rule is set to – Hostname - *amazonaws.com

4 weeks now and zero update on this bug.

Glad I didn’t waste my money on this plugin.

Hi @drgonzo3000, Apologies for the delayed response.

For the Browser user-agent to ignore option on Live Traffic, this is a single user-agent. Wildcards and multiple entries are not handled. 

For List of comma separated IP addresses to ignore, it does seem to work expected from your explanation,but please note that this option only applies to the general Live Traffic records, like showing pageviews. Security-related events such as logins are still included.

For the allowlist services, it looks like StatusCake added a new IP address that isn’t currently on our allowlist — I’ve passed this on to the Development Team and they are working on updating the list. Ideally, services like this should use a DNS PTR record to identify their own servers, rather than using the default AWS domains, but there are several services that don’t do that, unfortunately. For that reason, we don’t recommend blocking all AWS traffic.

Thanks,

Mark.

I need a way to filter out the statuscake and uptimerobot checks from the live logs, currently 90% of my live logs are nothing but the same requests from those checks which makes it near impossible to see anything else going on in the logs. Since those items are on the allowlist I would figure there would be some option to exclude them from the live logs just as I can do with my own IP address. Adding Statuscake IP’s to the ignore is not feasible as they have way too many from their various global nodes.